(a) One-call fraud alerts.
(1) Upon the direct request of a consumer,
or an individual acting on behalf of or as a personal representative
of a consumer, who asserts in good faith a suspicion that the consumer
has been or is about to become a victim of fraud or related crime,
including identity theft, a consumer reporting agency described in
section 603(p) that maintains a file on the consumer and has received
appropriate proof of the identity of the requester shall—
(A) include
a fraud alert in the file of that consumer, and also provide that
alert along with any credit score generated in using that file, for
a period of not less than 1 year, beginning on the date of such request,
unless the consumer or such representative requests that such fraud
alert be removed before the end of such period, and the agency has
received appropriate proof of the identity of the requester for such
purpose; and
(B)
refer the information regarding the fraud alert under this paragraph
to each of the other consumer reporting agencies described in section
603(p), in accordance with procedures developed under section 621(f).
(2) In any
case in which a consumer reporting agency includes a fraud alert in
the file of a consumer pursuant to this subsection, the consumer reporting
agency shall—
(A) disclose to the consumer that the
consumer may request a free copy of the file of the consumer pursuant
to section 612(d); and
(B) provide to the consumer all disclosures required to be made under
section 609, without charge to the consumer, not later than 3 business
days after any request described in subparagraph (A).
6-1555.31
(b) Extended alerts.
(1) Upon the direct request
of a consumer, or an individual acting on behalf of or as a personal
representative of a consumer, who submits an identity theft report
to a consumer reporting agency described in section 603(p) that maintains
a file on the consumer, if the agency has received appropriate proof
of the identity of the requester, the agency shall—
(A) include
a fraud alert in the file of that consumer, and also provide that
alert along with any credit score generated in using that file, during
the 7-year period beginning on the date of such request, unless the
consumer or such representative requests that such fraud alert be
removed before the end of such period and the agency has received
appropriate proof of the identity of the requester for such purpose;
(B) during the 5-year
period beginning on the date of such request, exclude the consumer
from any list of consumers prepared by the consumer reporting agency
and provided to any third party to offer credit or insurance to the
consumer as part of a transaction that was not initiated by the consumer,
unless the consumer or such representative requests that such exclusion
be rescinded before the end of such period; and
(C) refer the information regarding
the extended fraud alert under this paragraph to each of the other
consumer reporting agencies described in section 603(p), in accordance
with procedures developed under section 621(f).
(2) In any case in which a
consumer reporting agency includes a fraud alert in the file of a
consumer pursuant to this subsection, the consumer reporting agency
shall—
(A) disclose to the consumer that the
consumer may request 2 free copies of the file of the consumer pursuant
to section 612(d) during the 12-month period beginning on the date
on which the fraud alert was included in the file; and
(B) provide to the consumer
all disclosures required to be made under section 609, without charge
to the consumer, not later than 3 business days after any request
described in subparagraph (A).
6-1555.32
(c) Active duty alerts. Upon the direct request of an active duty military consumer, or
an individual acting on behalf of or as a personal representative
of an active duty military consumer, a consumer reporting agency described
in section 603(p) that maintains a file on the active duty military
consumer and has received appropriate proof of the identity of the
requester shall—
(1) include an active duty alert in the
file of that active duty military consumer, and also provide that
alert along with any credit score generated in using that file, during
a period of not less than 12 months, or such longer period as the
Bureau shall determine, by regulation, beginning on the date of the
request, unless the active duty military consumer or such representative
requests that such fraud alert be removed before the end of such period,
and the agency has received appropriate proof of the identity of the requester
for such purpose;
(2)
during the 2-year period beginning on the date of such request, exclude
the active duty military consumer from any list of consumers prepared
by the consumer reporting agency and provided to any third party to
offer credit or insurance to the consumer as part of a transaction
that was not initiated by the consumer, unless the consumer requests
that such exclusion be rescinded before the end of such period; and
(3) refer the information
regarding the active duty alert to each of the other consumer reporting
agencies described in section 603(p), in accordance with procedures
developed under section 621(f).
6-1555.33
(d) Procedures. Each consumer reporting agency
described in section 603(p) shall establish policies and procedures
to comply with this section, including procedures that inform consumers
of the availability of initial, extended, and active duty alerts and
procedures that allow consumers and active duty military consumers
to request initial, extended, or active duty alerts (as applicable)
in a simple and easy manner, including by telephone.
(e) Referrals of alerts. Each consumer
reporting agency described in section 603(p) that receives a referral
of a fraud alert or active duty alert from another consumer reporting
agency pursuant to this section shall, as though the agency received
the request from the consumer directly, follow the procedures required
under—
(1) paragraphs (1)(A)
and (2) of subsection (a), in the case of a referral under subsection
(a)(1)(B);
(2) paragraphs
(1)(A), (1)(B), and (2) of subsection (b), in the case of a referral
under subsection (b)(1)(C); and
(3) paragraphs (1) and (2) of subsection
(c), in the case of a referral under subsection (c)(3).
6-1555.34
(f) Duty of reseller to
reconvey alert. A reseller shall include in its report any fraud
alert or active duty alert placed in the file of a consumer pursuant
to this section by another consumer reporting agency.
(g) Duty of other consumer reporting agencies
to provide contact information. If a consumer contacts any consumer
reporting agency that is not described in section 603(p) to communicate
a suspicion that the consumer has been or is about to become a victim
of fraud or related crime, including identity theft, the agency shall
provide information to the consumer on how to contact the Bureau and
the consumer reporting agencies described in section 603(p) to obtain
more detailed information and request alerts under this section.
6-1555.35
(h) Limitations on use of
information for credit extensions.
(1) (A) Each initial
fraud alert and active duty alert under this section shall include
information that notifies all prospective users of a consumer report
on the con sumer to which the alert relates that the consumer does
not authorize the establishment of any new credit plan or extension
of credit, other than under an open-end credit plan (as defined in
section 103(i)), in the name of the consumer, or issuance of an additional
card on an existing credit account requested by a consumer, or any
increase in credit limit on an existing credit account requested by
a consumer, except in accordance with subparagraph (B).
(B) (i) No
prospective user of a consumer report that includes an initial fraud
alert or an active duty alert in accordance with this section may
establish a new credit plan or extension of credit, other than under
an open-end credit plan (as defined in section 103(i)), in the name
of the consumer, or issue an additional card on an existing credit
account requested by a consumer, or grant any increase in credit limit
on an existing credit account requested by a consumer, unless the
user utilizes reasonable policies and procedures to form a reasonable
belief that the user knows the identity of the person making the request.
(ii) If a consumer requesting
the alert has specified a telephone number to be used for identity
verification purposes, before authorizing any new credit plan or extension
described in clause (i) in the name of such consumer, a user of such
consumer report shall contact the consumer using that telephone number
or take reasonable steps to verify the consumer’s identity and confirm
that the application for a new credit plan is not the result of identity
theft.
6-1555.36
(2) (A) Each extended
alert under this section shall include information that provides all
prospective users of a consumer report relating to a consumer with—
(i) notification that the consumer does not authorize the establishment
of any new credit plan or extension of credit described in clause
(i), other than under an open-end credit plan (as defined in section
103(i)), in the name of the consumer, or issuance of an additional
card on an existing credit account requested by a consumer, or any
increase in credit limit on an existing credit account requested by
a consumer, except in accordance with subparagraph (B); and
(ii) a telephone number or other
reasonable contact method designated by the consumer.
(B) No prospective
user of a consumer report or of a credit score generated using the
information in the file of a consumer that includes an extended fraud
alert in accordance with this section may establish a new credit plan
or extension of credit, other than under an open-end credit plan (as
defined in section 103(i)), in the name of the consumer, or issue
an additional card on an existing credit account requested by a consumer,
or any increase in credit limit on an existing credit account requested
by a consumer, unless the user contacts the consumer in person or
using the contact method described in subparagraph (A)(ii) to confirm
that the application for a new credit plan or increase in credit limit,
or request for an additional card is not the result of identity theft.
(i) National security freeze.
(1) For purposes of this subsection:
(A) The term “consumer reporting agency” means a consumer reporting
agency described in section 1681a(p) of this title.
(B) The term “proper identification”
has the meaning of such term as used under section 1681h of this title.
(C) The term “security
freeze” means a restriction that prohibits a consumer reporting agency
from disclosing the contents of a consumer report that is subject
to such security freeze to any person requesting the consumer report.
(2) (A) Upon receiving a direct
request from a consumer that a consumer reporting agency place a security
freeze, and upon receiving proper identification from the consumer,
the consumer reporting agency shall, free of charge, place the security
freeze not later than—
(i) in the case of a request that is by toll-free
telephone or secure electronic means, 1 business day after receiving
the request directly from the consumer; or
(ii) in the case of a request that is by mail,
3 business days after receiving the request directly from the consumer.
(B)
Not later than 5 business days after placing a security freeze under
subparagraph (A), a consumer reporting agency shall—
(i) send confirmation
of the placement to the consumer; and
(ii) inform the consumer of—
(I) the process by which the consumer may
remove the security freeze, including a mechanism to authenticate
the consumer; and
(II)
the consumer’s right described in section 1681m(d)(1)(D) of this title.
(C) A consumer reporting agency may
advise a third party that a security freeze has been placed with respect
to a consumer under subparagraph (A).
(3) (A)
A consumer reporting agency shall remove a security freeze placed
on the consumer report of a consumer only in the following cases:
(i) Upon the direct request of the consumer.
(ii) The security freeze was placed due to
a material misrepresentation of fact by the consumer.
(B) If a consumer reporting
agency removes a security freeze under subparagraph (A)(ii), the consumer
reporting agency shall notify the consumer in writing prior to removing
the security freeze.
(C) Except as provided in subparagraph (A)(ii), a security freeze
shall remain in place until the consumer directly requests that the
security freeze be removed. Upon receiving a direct request from a
consumer that a consumer reporting agency remove a security freeze,
and upon receiving proper identification from the consumer, the consumer
reporting agency shall, free of charge, remove the security freeze
not later than—
(i) in the case of a request that is by toll-free
telephone or secure electronic means, 1 hour after receiving the request
for removal; or
(ii) in
the case of a request that is by mail, 3 business days after receiving
the request for removal.
(D) If a third party requests access
to a consumer report of a consumer with respect to which a security
freeze is in effect, where such request is in connection with an application
for credit, and the consumer does not allow such consumer report to
be accessed, the third party may treat the application as incomplete.
(E) Upon receiving
a direct request from a consumer under subparagraph (A)(i), if the
consumer requests a temporary removal of a security freeze, the consumer
reporting agency shall, in accordance with subparagraph (C), remove
the security freeze for the period of time specified by the consumer.
(4) A security
freeze shall not apply to the making of a consumer report for use
of the following:
(A) A person or entity, or a subsidiary,
affiliate, or agent of that person or entity, or an assignee of a
financial obligation owed by the consumer to that person or entity,
or a prospective assignee of a financial obligation owed by the consumer
to that person or entity in conjunction with the proposed purchase
of the financial obligation, with which the consumer has or had prior
to assignment an account or contract including a demand deposit account,
or to whom the consumer issued a negotiable instrument, for the purposes
of reviewing the account or collecting the financial obligation owed
for the account, contract, or negotiable instrument. For purposes
of this subparagraph, “reviewing the account” includes activities
related to account maintenance, monitoring, credit line increases,
and account upgrades and enhancements.
(B) Any Federal, State, or local agency,
law enforcement agency, trial court, or private collection agency
acting pursuant to a court order, warrant, or subpoena.
(C) A child support agency
acting pursuant to part D of title IV of the Social Security Act (42
U.S.C. 651 et seq.).
(D) A Federal agency or a State or its
agents or assigns acting to investigate fraud or acting to investigate
or collect delinquent taxes or unpaid court orders or to fulfill any
of its other statutory responsibilities, provided such responsibilities
are consistent with a permissible purpose under section 1681b of this
title.
(E) By a person
using credit information for the purposes described under section
1681b(c) of this title.
(F) Any person or entity administering a credit file monitoring subscription
or similar service to which the consumer has subscribed.
(G) Any person or entity
for the purpose of providing a consumer with a copy of the consumer’s
consumer report or credit score, upon the request of the consumer.
(H) Any person using
the information in connection with the underwriting of insurance.
(I) Any person using
the information for employment, tenant, or background screening purposes.
(J) Any person using
the information for assessing, verifying, or authenticating a consumer’s
identity for purposes other than the granting of credit, or for investigating
or preventing actual or potential fraud.
(5) At any time a consumer
is required to receive a summary of rights required under section
1681g of this title, the following notice shall be included:
“Consumers Have the Right
to Obtain a Security Freeze”
“You have a right to place a ‘security
freeze’ on your credit report, which will prohibit a consumer reporting
agency from releasing information in your credit report without your
express authorization. The security freeze is designed to prevent
credit, loans, and services from being approved in your name without
your consent. However, you should be aware that using a security freeze
to take control over who gets access to the personal and financial
information in your credit report may delay, interfere with, or prohibit
the timely approval of any subsequent request or application you make
regarding a new loan, credit, mortgage, or any other account involving
the extension of credit.
“As an alternative to a security freeze, you have the right to place
an initial or extended fraud alert on your credit file at no cost.
An initial fraud alert is a 1-year alert that is placed on a consumer’s
credit file. Upon seeing a fraud alert display on a consumer’s credit
file, a business is required to take steps to verify the consumer’s
identity before extending new credit. If you are a victim of identity
theft, you are entitled to an extended fraud alert, which is a fraud
alert lasting 7 years.
“A security freeze does not apply to a person or entity, or its affiliates,
or collection agencies acting on behalf of the person or entity, with
which you have an existing account that requests information in your
credit report for the purposes of reviewing or collecting the account.
Reviewing the account includes activities related to account maintenance,
monitoring, credit line increases, and account upgrades and enhancements.”
(6) (A) A consumer reporting agency
shall establish a webpage that—
(i) allows a consumer to request
a security freeze;
(ii)
allows a consumer to request an initial fraud alert;
(iii) allows a consumer to request an extended
fraud alert;
(iv) allows
a consumer to request an active duty fraud alert;
(v) allows a consumer to opt-out of the use
of information in a consumer report to send the consumer a solicitation
of credit or insurance, in accordance with section 1681m(d) of this
title; and
(vi) shall
not be the only mechanism by which a consumer may request a security
freeze.
(B) The Federal Trade Commission shall establish a single webpage
that includes a link to each webpage established under subparagraph
(A) within the Federal Trade Commission’s website www.Identitytheft.gov,
or a successor website.
(j) National protection for files and credit
records of protected consumers.
(1) As used in this subsection:
(A) The
term “consumer reporting agency” means a consumer reporting agency
described in section 1681a(p) of this title.
(B) The term “protected consumer” means
an individual who is—
(i) under the age of 16 years at the time
a request for the placement of a security freeze is made; or
(ii) an incapacitated person or
a protected person for whom a guardian or conservator has been appointed.
(C)
The term “protected consumer’s representative” means a person who
provides to a consumer reporting agency sufficient proof of authority
to act on behalf of a protected consumer.
(D) The term “record” means a compilation
of information that—
(i) identifies a protected consumer;
(ii) is created by a consumer
reporting agency solely for the purpose of complying with this subsection;
and
(iii) may not be created
or used to consider the protected consumer’s credit worthiness, credit
standing, credit capacity, character, general reputation, personal
characteristics, or mode of living.
(E) The term “security freeze” means
a restriction that prohibits a consumer reporting agency from disclosing
the contents of a consumer report that is the subject of such security
freeze or, in the case of a protected consumer for whom the consumer
reporting agency does not have a file, a record that is subject to
such security freeze to any person requesting the consumer report
for the purpose of opening a new account involving the extension of
credit.
(F) The term
“sufficient proof of authority” means documentation that shows a protected
consumer’s representative has authority to act on behalf of a protected
consumer and includes—
(i) an order issued by a court of law;
(ii) a lawfully executed
and valid power of attorney;
(iii) a document issued by a Federal, State, or local government
agency in the United States showing proof of parentage, including
a birth certificate; or
(iv) with respect to a protected consumer who has been placed in
a foster care setting, a written communication from a county welfare
department or its agent or designee, or a county probation department
or its agent or designee, certifying that the protected consumer is
in a foster care setting under its jurisdiction.
(G) The term “sufficient
proof of identification” means information or documentation that identifies
a protected consumer and a protected consumer’s representative and
includes—
(i) a social security number or a copy of
a social security card issued by the Social Security Administration;
(ii) a certified or official
copy of a birth certificate issued by the entity authorized to issue
the birth certificate; or
(iii) a copy of a driver’s license, an identification card issued
by the motor vehicle administration, or any other government issued
identification.
(2) (A) Upon receiving
a direct request from a protected consumer’s representative that a
consumer reporting agency place a security freeze, and upon receiving
sufficient proof of identification and sufficient proof of authority,
the consumer reporting agency shall, free of charge, place the security
freeze not later than—
(i) in the case of a request that is by toll-free
telephone or secure electronic means, 1 business day after receiving
the request directly from the protected consumer’s representative;
or
(ii) in the case of
a request that is by mail, 3 business days after receiving the request
directly from the protected consumer’s representative.
(B) Not later than
5 business days after placing a security freeze under subparagraph
(A), a consumer reporting agency shall—
(i) send confirmation of the
placement to the protected consumer’s representative; and
(ii) inform the protected consumer’s
representative of the process by which the protected consumer may
remove the security freeze, including a mechanism to authenticate
the protected consumer’s representative.
(C) If a consumer reporting
agency does not have a file pertaining to a protected consumer when
the consumer reporting agency receives a direct request under subparagraph
(A), the consumer reporting agency shall create a record for the protected
consumer.
(3) After a security freeze has been placed under paragraph (2)(A),
and unless the security freeze is removed in accordance with this
subsection, a consumer reporting agency may not release the protected
consumer’s consumer report, any information derived from the protected
consumer’s consumer report, or any record created for the protected
consumer.
(4) (A) A consumer reporting agency
shall remove a security freeze placed on the consumer report of a
protected consumer only in the following cases:
(i) Upon the
direct request of the protected consumer’s representative.
(ii) Upon the direct request
of the protected consumer, if the protected consumer is not under
the age of 16 years at the time of the request.
(iii) The security freeze was placed due to
a material misrepresentation of fact by the protected consumer’s representative.
(B)
If a consumer reporting agency removes a security freeze under subparagraph
(A)(iii), the consumer reporting agency shall notify the protected
consumer’s representative in writing prior to removing the security
freeze.
(C) Except
as provided in subparagraph (A)(iii), a security freeze shall remain
in place until a protected consumer’s representative or protected
consumer described in subparagraph (A)(ii) directly requests that
the security freeze be removed. Upon receiving a direct request from
the protected consumer’s representative or protected consumer described
in subparagraph (A)(ii) that a consumer reporting agency remove a
security freeze, and upon receiving sufficient proof of identification
and sufficient proof of authority, the consumer reporting agency shall,
free of charge, remove the security freeze not later than—
(i) in the case
of a request that is by toll-free telephone or secure electronic means,
1 hour after receiving the request for removal; or
(ii) in the case of a request that is by mail,
3 business days after receiving the request for removal.
(D) Upon receiving a
direct request from a protected consumer or a protected consumer’s
representative under subparagraph (A)(i), if the protected consumer
or protected consumer’s representative requests a temporary removal
of a security freeze, the consumer reporting agency shall, in accordance
with subparagraph (C), remove the security freeze for the period of
time specified by the protected consumer or protected consumer’s representative.
(k) Credit monitoring.
(1) In this subsection:
(A) The
term “active duty military consumer” includes a member of the National
Guard.
(B) The term
“National Guard” has the meaning given the term in section 101(c)
of title 10, United States Code.
(2) A consumer reporting agency described
in section 603(p) shall provide a free electronic credit monitoring
service that, at a minimum, notifies a consumer of material additions
or modifications to the file of the consumer at the consumer reporting
agency to any consumer who provides to the consumer reporting agency—
(A) appropriate proof that the consumer is an active duty military
consumer; and
(B)
contact information of the consumer.
(3) Not later than 1 year after the date
of enactment of this subsection, the Federal Trade Commission shall
promulgate regulations regarding the requirements of this subsection,
which shall at a minimum include—
(A) a definition of an electronic
credit monitoring service and material additions or modifications
to the file of a consumer; and
(B) what constitutes appropriate proof.
(4) (A) Sections 616 and 617 shall
not apply to any violation of this subsection.
(B) This subsection shall be enforced
exclusively under section 621 by the Federal agencies and Federal
and State officials identified in that section.
[15 USC 1681c-1.
As added by act of Dec. 4, 2003 (117 Stat. 1955) and amended by acts
of July 21, 2010 (124 Stat. 2087) and May 24, 2018 (132 Stat. 1326-32,
1334).]
